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FOREWORD 


This In-Space Propellant Logistics and Safety Study was performed by 
the Space Division of North American Rockwell Corporation for the National 
Aeronautics and Space Administration, Marshall Space Flight Center, under 
Contract NAS8-27692. The study was a twelve-month effort initiated on 
June 25, 1971, and completed on June 23, 1972. 

The study was conducted as two separate, but related projects. One 
project addressed the systems and operational problems associated with the 
transport, transfer, and storage of cryogenic propellants in low earth orbits, 
while the other project addressed the safety problems connected with in- 
space propellant logistics operations. Correlation between the two projects 
was maintained by including safety considerations resulting from the System 
Safety Analysis in the trade studies and evaluations of alternate operating 
concepts in the Systems/Operations Analysis. 

Walter E. Whitacre of Marshall Space Flight Center, Advanced Systems 
Analysis Office, was the Contracting Officer's Representative and-provided 
technical direction to the overall contract and to the Systems/Operations 
Analysis project; Walter Stafford of the same office provided technical 
direction to the System Safety Analysis project. The contractor effort was 
under the direction of Robert E. Sexton, Program Manager; the Systems/ 
Operations Analysis effort was led by Robert L. Moore and the System Safety 
Analysis effort was led by William E. Plaisted. Key technical contributors 
were G. F. Ruff, System Safety Analysis and Trade Studies, and J. R. Cook, 
Literature Review, Preventive Measures, and Guidelines and Requirements. 

This document is Volume II of the following three volumes which 
contain the System Safety Analysis. 

Volume I 

Volume II 


Volume III 

The results 
contained in the 

Volume I 

Volume II 


Executive Summary (SD 72-SA-0054-1) 

System Safety Guidelines and (SD 72-SA-0054-2) 

Requirements 

System Safety Analysis (SD 72-SA-0054-3) 

of the Systems/Operations Analysis portion of the study are 
following five volumes: 

Executive Summary (SD 72-SA-0053-1) 

Technical Report (SD 72-SA-0053-2) 
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Volume III 

Trade Studies 

(SD 72-SA-0053-3) 

Volume IV 

Project Planning Data 

(SD 72-SA-0053-4) 

Volume V 

Cost Estimates 

(SD 72-SA-0053-5) 


This volume contains the guidelines and requirements to be applied to 
the design and operation of systems to transport propellants into space for 
subsequent use by another vehicle, to store propellants in space, or to 
transfer propellants from one element to another in space. It identifies 
two distinct methods of using the Guidelines and Requirements. The first 
would use them to define a safe concept of propellant delivery, and the 
second would be to use them as a checklist to determine whether an established 
concept was a safe one. 
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1.0 INTRODUCTION 

This volume of the final report contains detailed system safety guide- 
lines/requirements (GLR's) developed during the course of the study. Each 
GLR describes a safety measure which is suggested as a means of eliminating 
or reducing a particular hazard, or group of hazards, to an acceptable level, 
and which, if followed would tend to increase the level of safety in supply- 
ing propellants to a user in orbit. 

The development of GLR's was intended to serve two goals. The first was to 
identify those actions that should be taken to make propellant logistics 
operations as safe as possible. The second was to serve as a checklist to 
verify that these actions had been taken in the design and operation of this 
and similar programs, or that they had been considered and rejected. 

The safety measures described in the GLR's are directed toward the 
prevention of hazards, the avoidance of undesired events, and the protection 
of the crew. Specific corrective action is, to a large measure, dependent 
on the state of events at the time of occurrence, the condition of the hard- 
ware after occurrence of the hazard, and upon the configuration of the systems 
in total. Measures for corrective action must be developed when the configura- 
tion of the system has been defined and the operational procedures are being 
written. 

The guidelines/requirements take into account the results of the analysis 
of all the preventive measures taken against all the hazards that were identi- 
fied. The study concentrated on propellant handling systems and operations in 
orbit. Hazards associated with ground and launch operations have also been 
studied and reported elsewhere; only such ground operations that would be 
unique to propellant logistics are reported here. These unique operations are 
concerned primarily with the use of slush propiellants . 

Several of the GLR's rely on the presence of monitoring devices for 
their execution. Section 5.3 of Volume III, "Monitoring Devices," contains 
a listing and a more detailed discussion of the need for these devices. 

Each GLR appears only once and is numbered in serial with the others. 

The first 48 GLR's are numbered in sequence in the order in which they would 
be applied during pre-launch, ascent, deployment, docking, transfer, retrieval, 
and re-entry. GLR's 49 through 63 apply to all propellant logistics operations. 
Examples of their application to safety-critical propellant logistics opera- 
tions are given. 
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2.0 DERIVATION OF GUIDELINES /REQUIREMENTS (GLR) 

As in-space propellant logistics operations were analyzed for system 
safety, each hazard was identified and was entered on a hazard analysis sheet 
(Figure 2.0-1). The conditions leading to and the effects of the hazard were 
presented in the hazard description/effects block. 

Preventive measures to be applied to eliminate the hazard or to reduce 
it to an acceptable level are presented in the action recommended block of 
the sheet. These measures are specific to the hazard postulated, with the 
stated systems being operated under the conditions stated. The goals of the 
preventive measures were practical solutions, using methods and techniques 
that have been proven successful in the past to solve similar problems with 
existing state-of-the-art. Extrapolations of the state-of-the-art have been 
identified. 

The preventive measures provided the basis for the development of GLR's. 

The measures were grouped under headings that also served as titles for 
individual GLR's. Each preventive measure developed has been included in at 
least one generalized GLR. 

2.1 GLR DESCRIPTION 

2.1.1 A GLR sheet is shown in Figure 2. 1.1-1. A description of each of the 
elements composing this sheet follows. 

2 . 1 . 1 . 1 Number 

The number was assigned in sequential order of use during a normal launch, 
orbital operation, and re-entry. The assigned number is used as an identifier 
throughout this volume. 

2. 1.1. 2 Hazard Group 

There were 12 hazard groups used in the study. These are representative 
of the hazards which could be broadly grouped from the various phases of the 
missions and operations of the representative orbital propellant logistic 
concept . 

Hazard Group 1 - Fire/Explosion/Implosion 

Group 1 includes hazards created by chemical reactions, catalytic action, 
frictional effects, or other heat generating principles. It further includes 
explosions initiated by fire or spark and those which are not necessarily fire 
initiated, such as overpressurization; instantaneous release of high pressures 
by container fracture; or reactions in ambient conditions where gaseous hydrogen 
and oxygen are combined in proportions of 4 and 2 percent by volume or greater 
and the resulting mixture is subjected to pressures of 2 mm of Mercury or more 
and is subjected to an initiation source, such as a catalytic reaction with a 
nickel, zirconium, etc., impact or spark. 
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Implosion includes those hazards in which an adverse a P is created across 
a structure (tank) by the reduction of internal pressure during such activities 
as drainage of fluid from a locked up volume, cryo-pumping , or venting to 
vacuum and locking the tank up for re-entry into the earth's atmosphere. 

Hazard Group 2 - Reduced Integrity of Structure or Equipment 

Group 2 includes conditions which subject a structure or equipment to 
some level of degradation, such as possible adverse stress due to exposure 
resulting from temperature extremes, interaction between fluids and materials, 
reduction in critical characteristics or materials capability, functional 
degradation due to loss of supporting equipment, and out of sequence operations. 

Hazard Group 3 - Contamination 

Group 3 includes hazards related to those conditions producing or intro- 
ducing contamination. The contamination ranges from traces to large particles, 
including products of combustion, ice crystals, and metal chips. 

Hazard Group 4 - Corrosion 

Group 4 includes those conditions which adversely damage personnel or 
material surfaces by chemical attack. 

Hazard Group 5 - Toxicity 

Group 5 includes hazards related to the production of a toxic substance 
which affects the human body adversely. 

Hazard Group 6 - Heat and Temperature 

Group 6 includes those conditions related to excursions of temperature 
ranging from extreme heat to extreme cold. 

Hazard Group 7 - Loss of Thrust 

Group 7 covers those cases where loss of thrust is experienced when it 
is needed for scheduled operations. In includes problems involved in main 
and auxiliary propulsion engines and propulsive vents. 

Hazard Group 8 - Unscheduled Vehicle Impact 

Group 8 includes impact hazards involving loss of target by the vehicle 
avionics or ground net; impact of meteoroid and/or space debris with the 
vehicle due to mechanical failures or delays in valve actuation for any 
reason; impact due to loss of docking aids or incorrect approach alignment; 
and impact from inadvertent misoperation of RCS, propulsive vents, etc. 
Manipulator related hazards, such as loss of TV and lighting, impact of the 
cargo with the structure, and damage caused by sloshing or unstabilizing 
effects are also included. Human error has been included in the group as 
related to impacts while is in manual control or commands are introduced for 
remote activation. 
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Hazard Group 9 - Loss of Attitude Control 

1 

Group 9 includes those hazards where the inability to achieve stabiliza- 
tion for any reason prevails, such as lack of or intermittent RCS operation 
and CG shift during rotation. This group also includes the conditions where 
application or release of tension loads causes instability within the con- 
figuration for any time duration without damping. 

Hazard Group 10 - Loss of Habitable Environment 

Group 10 includes any hazards which would render the manned volume unfit 
for unsuited occupancy, such as decompression by penetration, long-term leakage 
or seal failures which give unscheduled depletion of oxygen supply, contamina- 
tion, heat, humidity, and loss of CO2 control. 

Hazard Group 11 - Loss of Communication 

Group 11 includes loss of ability to send or receive programmed data under 
operational conditions. It encompasses radio, radar, laser, TV, and hard wire 
communications and necessary equipment, GSE, facilities, or satellites associ- 
ated with the communication process. 

Hazard Group 12 - Disturbances 

Group 12 includes those conditions which can adversely affect stability 
conditions, such as sloshing and CG shift coupled with the dynamics of the 
vehicle or configuration, with RCS interaction, with tank inlet fluid momentum 
distorting the liquid surface, or with combinations initiating such conditions, 
including impact and wobble. 

2. 1.1. 3 Mission Phase 

The mission phase block describes briefly the operation or group of 
operations taking place when the hazard occurs that the GLR is to prevent. 

These phases or events are described below. 

a. All will be used when the GLR applies to any propellant logistics 
operation that is performed on the ground, during ascent, or in 
orbit. 

b. Deployment consists of those functional steps that are to be per- 
formed to remove a propellant logistics element from the transport 
vehicle. 

c. Docking includes those operations performed to effect a mating, or 
joining, of two orbiting vehicles. 

d. EVA (extra vehicular activity) is that activity taking place outside 
the prime vehicle within a separate life support system (suit) that 
may or may not be connected by umbilicals to the prime vehicle. 
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e. Ground operations are those steps or functions performed on the ground 
to support the launch of a vehicle or to render assistance to an 
orbiting vehicle. 

f. Launch consists of those steps taken to transport a propellant 
logistics element from the ground into orbit. 

g. Manned operations are those functions performed with human assistance. 

h. Manned orbital operations are those functions performed in orbit with 
human assistance. 

i. Orbital assembly is the construction, in orbit, of a large assembly 
of elements that are transported to orbit individually by the trans- 
port vehicle. 

j . Orbital maintenance refers to those repairs made to a vehicle while 
in orbit . Maintenance by machine is not ruled out , but the prime 
concern in this type event is the performance of orbital maintenance 
by man. 

k. Orbital operations are those steps or functions performed upon or 
with orbiting propellant logistics elements. 

l. Prelaunch activity is that activity performed upon propellant 
logistics elements to prepare them for the launch operation. 

m. Propellant transfer is the act of transferring propellants from one 
tank to another. In the modular case, it would be the transposition 
of a propellant module from one position to another. 

n. Re-entry is the act of transporting a vehicle from orbit to earth. 
Sometimes de-orbit is used interchangeably with re-entry. 

o. Retrieval includes all those steps taken to remove an orbital element 
from a stationkeeping mode alongside a transport vehicle and to place 
the element in the cargo bay and prepare it for re-entry. 

p. Sub-orbital abort consists of those steps taken from the time that a 
transport vehicle fails to achieve earth orbit, for whatever reason, 
until the transport vehicle lands. 

2. 1.1. 4 Applicable Subsystems 

In this block will be entered the systems or functions that the stated 
guideline will affect. The terms used are in common use throughout the 
industry and need not be defined here. 

2. 1.1. 5 Guideline Title 

This is the verbal identifier for the GLR. 
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2. 1.1. 6 Guideline Statement 

This block contains the full GLR statement. 

2. 1.1. 7 Remarks 

A narrative statement of supporting data, further justification, or 
elaboration of the GLR statement is entered in this block. 

2. 1.1. 8 References 

The source of information that made the guideline statement necessary 
is entered in this block. Hazard analysis references will be entered as 
HA 12, which corresponds to Hazard Analysis Sheet 12. Literature references 
are in parenthesis and (69) would refer to that numbered document listed in 
Appendix H of Volume III of this report. 

2. 1.1. 9 Cross References 

The numbers of the additional GLR that support the guideline statement 
are entered in this block. 
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3.0 APPLICATION OF SYSTEM SAFETY GUIDELINES/REQUIREMENTS 

Guidelines/Requirements (GLR's) are applied according to two methods: 
Examples of the two methods are developed in this section. Figure 4.1-1 
presents the results of this development. GLR's are identified as applicable 
to the design or operational phase, or both, in the column headed "Type of 
GLR" in Figure 4.1-1. 

3.1 CONCEPT DEVELOPMENT 

In the development of a concept, the GLR can be used to provide the 
optimum degree of safety in propellant logistics design and operations. One 
of the requirements of the study was to develop GLR's for prelaunch and launch 
(including ascent), orbital operations and lunar operations. GLR's have been 
written for any concept developed for use in these three broad areas. 

3.1.1 Prelaunch and Launch (Including Ascent) 

The distinguishing features of this area of operations are the presence 
of gravity (earth gravity or that induced by acceleration) and an atmosphere 
that includes oxygen. The appropriate GLR's for the development of a concept 
to be used under these conditions are listed in Column 3.1.1 of Figure 4.1-1. 

3.1.2 Orbital Operations (Including Earth and Lunar Orbit) 

The distinguishing features of this area of operations are the absence 
or great reduction of gravity and atmosphere (including the absence of readily 
available oxygen) . In the development of a concept to be used under these 
conditions, the GLR's that should be taken into consideration are listed in 
Column 3.1.2 of Figure 4.1-1. 

3.1.3 Lunar Operations 

The distinguishing features of operating on the lunar surface are the 
presence of a significant gravitational force and the absence or great reduc- 
tion of atmosphere (including oxygen) . In the development of a concept to be 
used in lunar operations, the GLR's that should be considered are listed in 
Column 3.1.3 of Figure 4.1-1. 

3.2 DESIGN CHECKLIST 

GLR's can be used to verify that the optimum degree of safety has been 
incorporated into existing designs, as demonstrated in Figure 3.2-1. This 
figure portrays several propellant logistics concepts and the different 
requirements of four orbital operations. The vertical columns have been 
numbered, and the horizontal rows have been alphabetized in such a way that 
A. 2. 2 would be the operation of "remote hard dock CIS to LSF" under the base- 
line concept. The development of Figure 3.2-1 is discussed in Section 2.1 
of Volume III of this report. 
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3.2.1 Guidelines/Requirements Common to all Orbital Operations 

The GLR's that are common to any of the orbital operations in Figure 3.2-1 
are listed in Column 3.2.1 of Figure 4.1-1. 

3.2.2 Guidelines/Requirements Unique to Orbital Operations 

The additional GLR's that apply to specific operations are tabulated in 
Figure 4.1-1. Reference is made to Figure 3.2-1 for the identification of 
the operation in progress. 

3. 2. 2.1 A-l-1 Concept - Baseline 

Operation - Propellant Tank Module Deployed by Manipulators 
from Cargo Bay 

During this operation, the shuttle orbiter has delivered a propellant 
module to orbital altitude. The orbiting propellant depot has been assembled 
in orbit, and the shuttle is stationkeeping, with cargo bay doors open, and 
is ready to deliver a propellant module. Deployment will consist of those 
steps to be taken to sever the interface of the module and shuttle and to 
remove the module from the cargo bay by the use of manipulators. 

Since this is largely a manual operation, common GLR 57 (Automatic 
Operation) is applicable to supporting systems; and common GLR's 49 (Crew 
Fatigue), 61 (Crew Training), and 62 (Procedures Development), are applicable. 

Additions to the applicable common GLR's are listed in Column 3. 2. 2.1 
of Figure 4.1-1. 

3. 2. 2. 2 A-2-1 Concept - Baseline 

Operation - Shuttle Soft Docks Propellant Tank Module to 
LSF (Large Storage Facility) 

During this operation, the shuttle is stationkeeping with the LSF, with 
the propellant module on the extended manipulator arms. The manipulator 
arms are used to soft dock the module and rigidize it to the LSF. Then the 
orbiter translates away from the LSF/module combination. Included in this 
operation is the requirement to maintain vehicle stability while the element 
is attached to the manipulator arms. 

This operation is largely manual, since vehicle stability is critical. 
Common GLR 57 (Automatic Operations) is applicable to supporting systems and 
GLR 32 (Uncontrolled Oscillations), 33 (Fluid Sloshing, 34 (Non-Propulsive 
Vents) , 49 (Crew Fatigue) , 61 (Crew Training) , and 62 (Procedures Develop- 
ment should be emphasized. 

Additions to the common GLR that should be applied are listed in Column 

3. 2. 2. 2 of Figure 4.1-1. 
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3. 2. 2. 3 A-2-2 Concept - Baseline 

Operation - Remote Hard Dock CIS (Chemical Interorbital 
Shuttle) to LSF 

During this operation, the CIS will automatically dock with no manned 
assistance. Of significance is the large mass of both vehicles. Additional 
consideration would be given to momentum and the possible excursion of 
residual CIS propellants from one end of the tank to the other during the 
docking impact. The passive vehicle is the LSF; the active vehicle is the 
CIS. 


Since this is an unmanned operation, the GLR's that deal with the support 
of man in orbit do not apply. The common GLR's that should receive emphasis 
include 53 (Manual Override) , 57 (Automatic Operations) , 52 (Operations 
Monitor), and 63 (Malfunction Detection and Warning Devices). 

Additions to the common GLR that should be applied are listed in 
Column 3. 2. 2.3 of Figure 4.1-1. 

3. 2. 2.4 A-3-1 Concept - Baseline 

Operation - Rotational Acceleration of LSF for Propellant 

Settling — CIS/RNS (Re-usable Nuclear Shuttle) — 
Orbiter Unattached 

During this operation, the LSF and CIS/RNS have docked, the interface 
has been rigidized, and pretransfer operations have been completed. Rotational 
acceleration is initiated by firing the RCS of the coupled elements to achieve 
the necessary rotational speed to settle the propellants. 

Since this is an automatic propellant transfer, automatic operations are 
emphasized. Common GLR's that should receive emphasis are 53 (Manual Over- 
ride), 57 Automatic Operations, 52 (Operations Monitor), and 63 (Malfunction 
Detection and Warning Devices. 

Additions to the common GLR's that should be applied are listed in 
Column 3. 2. 2. 4 of Figure 4.1-1. 

3. 2. 2. 5 A-4-1 Concept - Baseline 

Operation - Propellant Tank Retrieval — Emplacement in Cargo 
Bay and Deorbit- of Orbiter 

During this operation, the orbiter stationkeeps with the stable LSF, 
removes the empty module from the LSF, translates away, positions the module 
in the cargo bay, makes necessary verification tests, closes the doors and 
deorbits. The stability of the module while on the manipulator arms and the 
influence of residual propellants are primary concerns. 


- 12 - 


SD72-SA-0054-2 




Space Division 

North American Rockwell 


Retrieval operations are largely manual, and associated common GLR's will 
receive the same emphasis as in A-l-1 above. The preparation for deorbit and 
the deorbit phase are critical to the orbiter and crew, and the applicable 
GLR's are listed in Column 3. 2. 2. 5 of Figure 4.1-1. 

3. 2. 2. 6 B-2-1 Concept - Orbiter/Tug/LSF 

Operation - Remote Hard Dock Tug/Module to LSF 

Once a baseline concept has been established, modifications to that 
baseline will introduce other hazards that must be countered with additional 
GLR's. The new elements that have been added by this operation are the 
remote automatic docking of a small mass (tug) to a large mass (LSF) . The 
common GLR that should be emphasized is 32 (Uncontrolled Oscillations). 

Additions to the common GLR that should be applied are listed in 
Column 3. 2. 2. 6 of Figure 4.1-1. 

3. 2. 2. 7 C-2-1 Concept - Booster/ESS (Expendable Second Stage) Large 

Propellant Tank 

Operation - Remote Hard Dock of Large Propellant Tank with 
CIS/RNS 

The added operation is the remote, automatic docking of a large tank 
with another large mass (CIS/RNS) after the tank has been boosted by the 
ESS. Common GLR 32 (Uncontrolled Oscillations) should be emphasized. 

Additions to the common GLR that should be applied are listed in 
Column 3. 2. 2. 7 of Figure 4.1-1. 

3. 2. 2. 8 D-3-1 Concept - Orbiter to Orbiter 

Operation - Flex Lines used by Attaching at QD (Quick 
Disconnect) with use of Manipulators 

During this operation the additional elements are the stationkeeping 
of two orbiters and the use of manipulators to hook up flex lines in 
preparation for propellant transfer. 

Common GLR's that should receive emphasis are 32 (Uncontrolled Oscilla- 
tions), 29 (Ejected Material), 49 (Crew Fatigue) , 61 (Crew Training), and 
62 (Procedures Development) . 

3. 2. 2. 9 D-3-2 Concept - Orbiter to Orbiter 

Operation - Positive Displacement Method Used for Propellant 
Transfer 

The additional element in this operation is the introduction of bladders 
or diaphragms for fluid expulsion. The requirement to maintain stabilization 
and orbiter spacing and the common GLR's are the same as for D-3-1 above. 
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Additions to the common GLR's that should be applied are listed in 
Column 3. 2. 2. 9 of Figure 4.1-1. 

3.2.2.10 E-l-1 Concept - Orbiter to Tug 

Operation - Propellant Tank Module Deployed by Rotational 
Deployment Mechanism 

During this operation, the rotation devices are introduced to deploy a 
propellant module out of the cargo bay of the shuttle. An item of concern 
is the lateral stability of the module while it is being rotated out of the 
cargo bay. The common GLR 32 (Uncontrolled Oscillations) should be emphasized. 

Additions to the common GLR that should be applied are listed in Column 

3.2.2.10 of Figure 4.1-1. 

3.2.2.11 E-3-1 Concept - Orbiter to Tug 

Operation - Rotational Acceleration for Propellant Settling 
with Orbiter Attached 

For this operation, the orbiter remains attached to serve as a counter- 
weight while propellants are transferred from a module to a tug. Of signifi- 
cance is the fact that the orbiter crew remains relatively inactive for long 
periods (ten-hour transfer time) and is subject to any instability introduced 
by the assembly that might be detrimental to human performance. 

For this operation, common GLR's 32 (Uncontrolled Oscillations) and 49 
(Crew Fatigue) should receive emphasis. 

Additions to the common GLR's that should be applied are listed in 
Column 3.2.2.11 of Figure 4.1-1. 

3.2.2.12 E-3-2 Concept - Orbiter to Tug 

Operation - Linear Acceleration for Propellant Settling 
with Orbiter Attached 

This combination introduces linear acceleration for extended periods 
with low-thrust engines. Again, the orbiter crew is relatively inactive 
for ten hours and subject to any instability introduced by the assembly 
that might be detrimental to human performance. Common GLR's that receive 
emphasis are 32 (Uncontrolled Oscillations, 50 (Redundancy), and 49 (Crew 
Fatigue) . 

Additions to the common GLR's that should be applied are listed in 
Column 3.2.2.12 of Figure 4.1-1. 
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3.2.2.13 F-2-1 Concept - Orbiter to CIS/RNS 

Operation - Orbiter Hard Docks Propellant Tank Module to 
CIS/RNS 

During this operation, the orbiter is required to stationkeep with a 
modular CIS, remove a module from the cargo bay and soft-dock it to the CIS, 
rigidize the module, and translate away. The requirement to maintain con- 
trolled orbiter spacing from the CIS makes the common GLR's 32 (Uncontrolled 
Oscillations) and 61 (Crew Training) especially important. 

Additions to the common GLR's that should be applied are listed in 
Column 3.2.2.13 of Figure 4.1-1. 

3.2.2.14 G-l-1 Concept - Orbiter to Modular CIS 

Operation - Propellant Tank Module Deployed by Rotational 
and Manipulator Mechanisms 

During this operation, the use of manipulators and rotational modes of 
deployment are combined. The common GLR's to be emphasized are 32 (Uncontrolled 
Oscillations), 61 (Crew Training), and 62 (Procedures Development). 

Additions to the common GLR's that should be applied are listed in 
Column 3.2.2.14 of Figure 4.1-1. 

3.2.2.15 F-3-1 Concept - Orbiter to CIS/RNS 

Operation - Linear Acceleration for CIS/RNS/Tank Module 

Propellant Settling with Orbiter not Attached 

During this operation, the assembled CIS or RNS with the tank module 
attached is linearly accelerated for long periods of time. The common GLR's 
to be emphasized are the same as for E-3-2. 

The additions to the common GLR's that should be applied are listed in 
Column 3.2.2.15 of Figure 4.1-1. 

3.2.2.16 F-3-2 Concept - Orbiter to CIS/RNS 

Operation - Capillary Fluid Control for CIS/RNS Tank 
Module Propellant Transfer 

During this operation, the use of capillary devices is introduced for 
propellant settling. Since these devices are static in their operation, no 
one common GLR would receive special emphasis. 

Applicable GLR's are listed in Column 3.2.2.16 of Figure 4.1-1. 
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4.0 IN-SPACE PROPELLANT SYSTEM SAFETY (ISPSS) GUIDELINES/REQUIREMENTS 
4.1 SUMMARY OF THE APPLICATION OF GUIDELINES /REQUIREMENTS 

Figure 4.1-1 is a summary of the results of the preceding sections. 

This figure contains a complete listing of the GLR's by number and title. 
The first two columns headed by "Type of GLR" indicate whether the GLR would 
be applied during the design or operational phase, or both. An "X" at the 
intersection of the rows and columns indicates the applicability of the 
particular GLR during that phase. 

The columns headed by 3.1 indicate the applicability of the GLR during 
concept development . 

The columns headed by 3.2 indicate the applicability of the GLR as a 
checklist to determine whether the concept is optimized for safety. An "0" 
in these rows and columns indicates a GLR that would be common to any orbital 
operation that must be emphasized for a specific orbital mission. These 
specific orbital missions are described in the paragraph number at the head 
of the column. 
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Figure 4.1-1 

Summary of the Application of In-Space System Safety (ISPSS) Guidelines/Requirements 
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FIN 160 


I SPSS GUIDELINE/REQUIREMENT 


NO. 1 


HAZARD GROUP: 2 

MISSION PHASE: 


Pre-launch 


APPLICABLE SUBSYSTEMS: 

Pressurized Systems 


GUIDELINE TITLE: 


Proof Pressure Tests 


STATEMENT: arr PRESSURIZED CONTAINERS SHALL BE PROOF-TESTED AFTER FABRICATION TO 

LEVELS GREATER THAN THEIR OPERATING PRESSURE (HYDROSTAT 1-1/2 TIMES OPERATING, 
PNEUMOSTAT 1-1/4 TIMES OPERATING) . 


dc * 

The proof test is considered necessary as the final confirmation of design 
and fabrication of pressure vessels. At least one representative unit will be life- 
tested by pressurizing to operating level or above and relieving the pressure to 
ambient for as many cycles as the unit is to be exposed in service. 


REFERENCES: 


HA 11, 12, 


38, 44, 49, 


CROSS REFERENCES: 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 2 


HAZARD GROUP: 2 


MISSION PHASE: 



Pre-launch, Retrieval 

APPLICABLE SUBSYSTEMS: 

All 



GUIDELINE TITLE: Installation Verification 

STATEMENT: AFTER THE INSTALLATION OF A PROPELLANT LOGICTICS ELEMENT IN THE CARGO 

BAY OF THE SHUTTLE, VISUAL INSPECTION, LEAK TEST AND ELECTRICAL TESTS SHALL BE 
CONDUCTED TO VERIFY THAT THE ELEMENT HAS NOT BEEN DAMAGED BY THE INSTALLATION. 


REMARKS * 

Unnoticed damage to insulation, structures or other systems could occur on 
ground installation or orbital retrieval and emplacement of the element in the shuttle cargc 
bay. Insulation damage could lead to intolerable propellant boil-off and other systems 
damage could lead to mission loss from other sources. The post-installation tests should 
be used to verify that any system to be used in subsequent operations will successfully 
perform its function. 


REFERENCES: 


CROSS REFERENCES: 


HA 8 


63 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 



3 

HAZARD GROUP : 1 

MISSION PHASE: 



Pre-launch, Launch, Retrieval 

APPLICABLE SUBSYSTEMS: 

Propellant Tanks, ! 

Shuttle Interface 



GUIDELINE TITLE: Propellant Leakage into Cargo Bay of Shuttle 


STATEMENT: PROPELLANT LOGISTICS ELEMENTS SHALL BE LEAK CHECKED TO VERIFY THAT THE 

LEAKAGE OF HYDROGEN SYSTEMS IS WITHIN SPECIFICATION TOLERANCE PRIOR TO PRE-LAUNCH 
LOADING AND PRIOR TO RE-ENTRY FROM ORBIT. 


REMARKS: For a complete discussion of the hydrogen leakage problem, refer to Vol III 

Section 4.2. The following summarizes the results of this analysis and details the minimum 
steps that need to be taken to reduce this hazard. 

On the Ground: 

1. Perform a leak check on the propellant logistics element prior to placing it in 
the cargo bay. 

2. Verify that the element/orbiter interface is leak-tight and that no leaks developed 
in the element during installation. 

3. Provide a ground, inert gas purge to dilute H 2 from credible leaks to less than 
4% by volume in the cargo bay. 

4. Provide hydrogen, oxygen and fire detectors for the cargo bay. 

5. Provide emergency propellant un-loading capability. 

Prior to De-Orbit: 

1. Perform a visual inspection & leak-check of element by TV or through the view 
ports, prior to retrieval. Liquid leaks in a hard vacuum are highly visible. 

2. Inspect cargo bay for evidence of propellant "ice." 

3. Install element in cargo bay, leak check element, & interface between transport 
vehicle and element. 

4. Dump residual propellants after settling before or after installation. 

5. Verify tank pressure is within structural limits of atmospheric pressure. This 
series of leak checks will ensure that any leaks greater than normal are 
detected. Normal leakage is not hazardous for the currently considered 
propellant logistics elements. 


REFERENCES: V0L . IIZ> S ec. 4 . 2.5 

(15), (16), (17), (18), (20), (21) 


CROSS REFERENCES: _ . 

2, 4, 

46, 47, 48, 51, 55, 63 


5, 


6 , 


7, 
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ISPSS GUIDELINE/REQUIREMENT 


NO. 


HAZARO GROUP: 


MISSION PHASE: 

Pre-launch, Docking, Retrieval 


APPLICABLE SUBSYSTEMS: 


Fluid Line Interface Connections 


GUIDELINE TITLE: 

Fluid Line Interconnect Verification 


STATEMENT: 

ELEMENTS ARE 
TRANSFERRED. 


PROVIDE A MEANS TO VERIFY THAT THE FLUID LINES OF PROPELLANT LOGISTICS 
CONNECTED AND THAT THE INTERFACE IS LEAK FREE BEFORE FLUIDS ARE 


REMARKS. The fluid connections between propellant logistics elements and between 
the module and shuttle are critical to efficient propellant transfer and safe 
or ^ ,; *- t - er return. A partially engaged or leaking fluid interface connection could 
lead to the loss of the propellant logistics mission or to fire/explosion in the 
cargo bay. 

When the fluid lines are connected and rigidized, the monitor shall have verifi- 
cation of this fact. Before fluid is transferred, or before re-entry of the shuttle, 
the fluid connection shall be verified to be free of hazardous leaks. 


REFERENCES: 


HA 90, 


112, 116 


CROSS REFERENCES: 


47, 63 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 5 


HAZARD GROUP: 


MISSION PHASE: 

Pre-launch, Docking, Retrieval 


APPLICABLE SUBSYSTEMS: 


Electrical Interface Connections 


GUIDELINE. TITLE. Electrical Line Interconnect Verification 


TEMENT. provide A MEANS TO VERIFY THAT THE ELECTRICAL INTERFACE BETWEEN PROPELLANT 
LOGISTICS ELEMENTS ARE ATTACHED AND THAT THE CONNECTION PROVIDES ELECTRICAL ISOLATION 
BETWEEN CONDUCTORS AND CONTINUITY WITHIN CONDUCTORS BEFORE PROCEEDING TO SUBSEQUENT 
OPERATIONS . 


REMARKS : 

The electrical connections that will transmit data and control signals 
between propellant logistics elements and between the module and shuttle is critical 
to propellant transfer and safe orbiter return. A partially engaged electrical inter- 
face or intermittent contact or shorts between conductors could lead to loss of control 
of subsequent operations or loss of data with which to conduct subsequent operations. 

When the electrical interface is connected and rigidized the monitor shall have 
verification of this fact and prior to subsequent operations tests shall be conducted 
to verify that all electrical conductors have been properly mated. 


REFERENCES: 

CROSS REFERENCES: 

HA 35, 90, 127 

52, 63 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 6 


HAZARD GROUP: 

1 

MISSION PHASE: 

Ground Operations 

APPLICABLE SUBSYSTEMS: Caution and Warning 

System 

GUIDELINE TITLE: r „ 

Cargo Bay Fire Detectors 



STATEMENT: FIRE DETECTORS SHALL BE PROVIDED FOR THE CARGO BAY OF THE SHUTTLE 

DURING PROPELLANT LOGISTICS OPERATIONS. 


REMARKS: 

Fire detectors that indicate . rising temperature in time to take 
corrective action and prevent or minimize fire damage must be provided for the cargo 
bay when it contains a propellant logistics element. 


REFERENCES: 

CROSS REFERENCES: 

HA 2 

63 


_ 24 - SD7 2-SA-0054-2 




FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 7 


HAZARD GROUP: 


1 


MISSION PHASE: 


Ground Operations 


APPLICABLE SUBSYSTEMS: 


Caution and Warning System 


GUIDELINE TITLE: 

Cargo Bay Hazardous Gas Detectors 

STATEMENT: 

GAS DETECTORS SHALL BE PROVIDED TO INDICATE THE CONCENTRATION 
OF COMBUSTIBLE GAS IN THE CARGO BAY 


REMARKS: 

During pre-launch operations the gas detectors would provide information 
on the presence of leaks that had developed during the loading operation. Procedures 
shall be developed that will detail the corrective action to be taken to prevent or 
minimize fire damage that could occur as a result of the presence of the hazardous gas. 


REFERENCES: 


CROSS REFERENCES: 63 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 8 


HAZARD GROUP: L 

MISSION PHASE: 


Pre-launch 

APPLICABLE SUBSYSTEMS: 


Confined Compartments 


GUIDELINE. TITLE: Ground Purge 


STATEMENT: ALL CONFINED VOLUMES OF PROPELLANT LOGISTICS ELEMENTS SHALL BE PURGED 

WITH AN INERT GAS TO PREVENT THE ACCUMULATION OF EXPLOSIVE PROPELLANT MIXTURES . 


DC LjADl/C » 

Propellant logistics elements are designed to prevent restricted 
volumes. When they are enclosed in restricted volumes such as the cargo bay of the 
shuttle normal leakage will, in time, accumulate explosive mixtures. For this reason 
restricted volumes should be purged with an inert gas in sufficient volume to prevent 
the accumulation of hazardous concentrations of propellants (4% by volume of hydrogen) . 
Further considerations would be the elimination of pockets or dead spaces that did not 
receive purge flow and the protection of pad personnel from suffocation from the large 
volumes of inert gas that would be required. 


REFERENCES: 

161 


HA 4, 46, 51, 


CROSS REFERENCES: 


52, 97, 120, 121, 


6, 7 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 9 


HAZARD GROUP: 


MISSION PHASE: 


1, 2 





Pre-launch, Orbital Operations 


APPLICABLE SUBSYSTEMS: 

Facility and Vehicle Vent System 



GUIDELINE TITLE: 


Expansion of Melting Solid Cryogen 


STATEMENT: 

FACILITY AND VEHICLE VENT SYSTEMS MUST BE CAPABLE OF HANDLING LIQUID 
AND GASEOUS CRYOGENS . 


REMARKS: The primary reason for considering the use of slush cryogens in propellant 

logistics is the density advantage. For instance, solid hydrogen is 22.4% more dense 
than an equivalent weight of liquid hydrogen. The design ullage for propellant 
modules is generally 5%. A prolonged delay in the launch or insulation loss leading 
to abnormally high heat leaks into the module will melt the solid fraction. The 
melting solid would expand and overflow the tank. A vent system would have to be 
provided to accommodate the liquid and attendant high volumes of gaseous propellant 
that would be produced. One pound of LH2 forms 194.5 ft3 of gas at 25® C and 1 
atmosphere. Thus the volume change is approximately 860. This high volume flow in 
long vent lines could reflect high back-pressures into the propellant tank and 
over-stress the tank. 


REFERENCES: 


CROSS REFERENCES: 


HA5 (12), (13) 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 10 


HAZARD GROUP: 

2 


MISSION PHASE: 

Propellant Transfer 

APPLICABLE SUBSYSTEMS: 

Propellant Tanks and Lines 


GUIDELINE TITLE: Solid/Liquid Separation in Slush Cryogens 


STATEMENT: 

A MEANS MUST BE PROVIDED TO INSURE A UNIFORM MIXTURE OF THE LIQUID AND 
SOLID PHASE OF SLUSH PROPELLANTS DURING PROPELLANT TRANSFER. 


REMARKS: 

The solid particles of slush propellants are more dense than the liquid portion. 
Under the influence of gravity, the solid particles will settle to the bottom of the 
container and be the first available for withdrawing by the propellant transfer pumps. 

At the worst, this could lead to conpaction or bridging of the solid particles and 
interruption or total blockage of the propellant flow and inability to control propellant 
flow. A total blockage of propellant flow would prevent off-loading propellants 
during an emergency, until heat-leaks melted the solid plug. At the least, a non-homo- 
genuous mixture of solids and liquids would be transferred. 

During ground loading this could lead to the inability to get enough solids in the 
propellant module to achieve the required solid fraction and possible compromise of 
the mission. 

Solid/liquid separation could also occur when the flow velocity is not above a critical 
minimum and the solid particles settle to the bottom of the transfer line. 


REFERENCES: 


HA 4, 


CROSS REFERENCES: 


(52) 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


HAZARD GROUP: 


NO. 

11 


MISSION PHASE: 

Pre-Launch, Launch, Orbital Operations 


APPLICABLE SUBSYSTEMS: Propellant Management 


GUIDELINE TITLE: 
STATEMENT: 


Solid Fraction Measurement In Slush Propellants 

A MEANS MUST BE PROVIDED TO MEASURE THE SOLID FRACTION OF SLUSH 
PROPELLANTS IN PROPELLANT LOGISTICS TANKS. 


REMARKS : 

The solid fraction of slush propellants will expand upon melting. Sufficient ullage 
volume will have to be allowed to compensate for this increased volume of liquid 
as the solid fraction melts from heat leaks. 

If sufficient volume is not available to accomodate the expansion of melting solids 
the unscheduled release of liquid/solid mixture could effect vehicle stability, 
impinge on surfaces of other vehicles or obscure visual aids. 


REFERENCES: 

CROSS REFERENCES: 

(12), (13) 

9, 34, 55, 58 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 

12 


HAZARD GROUP: 

MISSION PHASE: 

1 

Pre-Launch 


APPLICABLE SUBSYSTEMS: 


Propellant and Pressurization 


GUIDELINE TITLE: Loading, Un-Loading Propellants 


STATEMENT: 

LIQUID OXYGEN SHALL BE LOADED INTO PROPELLANT LOGISTICS ELEMENTS BEFORE LIQUID 
HYDROGEN, FAIL-SAFE EMERGENCY UN-LOADING PROVISIONS SHALL BE INCORPORATED INTO 
VEHICLE AND FACILITY SYSTEMS. 


REMARKS: 

The sequence of loading propellants into a dual-propellant logistics module while 
in the cargo bay of the shuttle shall be LOX first, then liquid hydrogen. 

(Ref. 48) 

Should an emergency, such as fire, arise while the transport vehicle is still 
on the pad it will be necessary to un-load propellants from the Propellant 
Logistics Module. Even though the propellants were loaded in series, emergency 
conditions could dictate that the propellants shall be un-loaded in parallel 
in order to save time. The un-loading system shall be designed to accomplish 
un-loading in the time-limits established by the performance of the same task 
on the transport vehicle. As the propellants are drained by gravity and tank 
pressure the displaced volume shall be replaced by a compatible gas at a pressure 
no greater than that to be used in ascent. If the emergency causes power to 
fail to the valves used for un-loading, tank pressurization and the provision 
of Ground Purge, 8, the system shall fail to a safe mode of operation. 


REFERENCES: 

CROSS REFERENCES: 

HA7 (48) 

13, 48 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 13 



APPLICABLE SUBSYSTEMS: 


Propellant, Pressurization 


GUIDELINE TITLE: Negative Tank Pressure 


STATEMENT: 


PROPELLANT TANK SYSTEMS MUST BE DESIGNED TO AVOID FAILURE FROM NEGATIVE 

TANK PRESSURE. 


REMARKS: 

During the pre-launch and launch preparations a planned or inadvertant propellant 
dump could lower the ullage pressure of the tank and lead to collapse of the 
tank structure if a fail-safe means of re-pressurizing the tank with a compatible gas 
were not incorporated. Tank collapse would dump large quantities of propellants into 
the cargo bay and cause the loss of the transport vehicle & crew by fire or explosion. 

During the preparations for shuttle de-orbit the tank pressure of the module must 
be verified to be within structural limits of atmospheric pressure before committing 
to de-orbit. Tank collapse when the transport vehicle reaches the sensible atmosphere 
could cause massive leaks of hydrogen that would mix with atmospheric oxygen inside 
the cargo bay and be ignited by heat, shock, or catalytic action and lead to the loss 
of the transport vehicle and crew. If the tank pressure cannot be verified to be 
acceptable it shall not be returned in the transport vehicle. 


REFERENCES: ha 1, 71, 85, 87 


CROSS REFERENCES: 


31 - 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. i4 


HAZARD GROUP: 


1 , 


2 


MISSION PHASE: 


Launch 


APPLICABLE SUBSYSTEMS: 


Propellant and Pressurization 


GUIDELINE TITLE: Sub-Orbital Abort 


STATEMENT : in CASE OF ORBITER SUB-ORBITAL ABORT THE PROPELLANT LOGISTICS ELEMENT 

SHALL HAVE THE CAPABILITY TO SAFELY DUMP PROPELLANTS TO MEET THE 
40,000 LB. ORBITER LANDING LIMITATIONS IN THE MINIMUM TIME (ORBITER 
FLIGHT TIME) AVAILABLE FOR PROPELLANT DUMPING. 


REMARKS: 

In case of a booster failure prior to staging the orbiter must have intact abort 
capability. The orbiter has the ability to land with a 40 k Lb. payload. 

Heavier payloads can be landed with a reduced factor of safety. If 
the propellant logistics element is the orbiter cargo and weighs more than 40 K Lb. 
it must dump propellants to reduce weight. If the element contains both propellants 
or LOX only it would be preferable to dump LOX because it is more dense and incombustible. 
If the module contains hydrogen only and dumping is necessary the orbiter dump lines 
must be designed to prevent back-diffusion of atmospheric oxygen into the hydrogen 
lines/tanks. The orbiter flight attitude must be optimized to minimize the affect 
of the trailing, and probably burning, cloud of hydrogen. The time available for 
dumping, in the worst case, will be approximately 200 sec. This minimum time is 
established by the orbiter flight time between the beginning of the abort sequence 
and landing. 


REFERENCES: 

HA 76, 77 

CROSS REFERENCES: l2> u> 48 



- 32 - SD72-SA-0054-2 








FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 15 


HAZARD GROUP: i 

.... ■ 

MISSION PHASE: 

Sub-Orbital Abort, Re-Entry 

APPLICABLE SUBSYSTEMS: Vent/Dump System 



GUIDELINE TITLE: Vent/Dump System 


STATEMENT: FOR TRANSPORTING- PROPELLANT LOGISTICS ELEMENTS WITHIN ITS CARGO 

BAY, THE ORBITER MUST PROVIDE A CLOSED . VENT /DUMP SYSTEM WHICH 
TERMINATES OUTSIDE THE CARGO BAY AND WHICH IS COMPATIBLE WITH 
THE LOGISTICS ELEMENT. 


REMARKS: 

Tank vents systems must be provided for the elements that allow the tanks to vent 
outside the cargo bay. This venting system must be capable of passing the gas that 
might be generated in the propellant tanks without over-stressing the tank. 

Under zero "G" conditions local hot spots could develop because of heat leaks through 
lost or damaged insulation. When the propellant tank again came under the influence 
of gravity while in the cargo bay the residual liquid propellants could contact the hot 
spot and rapidly flash into vapor. The vent valves and lines must be large enough 
to prevent this pressure increase from over-pressurizing the tank. 

When the vehicle has common vent and dump line the line will be sized to permit dumping 
the required amount of liquid in the minimum amount of time available for dumping. 

The line size to be installed will be governed by the maximum size required to vent 
the gases or dump the liquids, whichever is larger. 


REFERENCES: 


HA 76 


CROSS REFERENCES: 


3, 4, 14, 28, 47, 48 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 16 


HAZARD GROUP: 10 


MISSION PHASE: 


Manned Orbital Operations 


APPLICABLE SUBSYSTEMS: Life Support System (LSS) 


GUIDELINE TITLE: 


Contamination of LSS 


STATEMENT: 


THE LSS OF MANNED PROPELLANT LOGISTICS ELEMENTS SHALL NOT PRODUCE 
TOXIC PRODUCTS OR BECOME CONTAMINATED BY TOXIC PRODUCTS FROM EXTERNAL 

SOTIROKS. 


REMARKS: 

The life support system of orbital storage depots must be designed for long-term use, 
or periods of intermitten use over long periods. These systems must not generate within 
themselves products that would be harmful to man or be subject to the introduction of 
harmful products from sources external to themselves. Prior to the use or reuse of 
such a LSS it must be verified to be operable and capable of supporting the crew without 
introducing toxic products. 


REFERENCES: ttao ^ 

CROSS REFERENCES: 

HA33 

56 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 


17 


HAZARD GROUP: 


MISSION PHASE: 


EVA 


APPLICABLE SUBSYSTEMS: 


Life Support 


GUIDELINE TITLE: E VA Operations 


STATEMENT: 


EVA SHALL BE MINIMIZED DURING ORBITAL PROPELLANT LOGISTICS OPERATIONS. 


REMARKS: 

Propellant logistics systems shall not be designed or operated to require EVA for mission 
completion. 

As a critical part of the man/machine system the elements that deal with mans protection in 
the space environment should have the same or greater level of redundancy as other critical 
elements in this system. Such is not the case with elements associated with EVA. There is 
no second pressurized volume to which the man could retreat in the event the first volume (suit) 
loses oxygen pressure because of rupture, puncture, or rips or umbilicals becoming fouled 
or kinked on obstructions. The decision to go EVA should be made where the benefits to 
be derived are commensurate with the risk to the crewman. 


REFERENCES: Study Ground Rules 


HA 70 


CROSS REFERENCES: 


18, 19, 60 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 18 


HAZARD GROUP: 


MISSION PHASE: 


Orbital Assembly, 
Orbital Maintenance 


APPLICABLE SUBSYSTEMS: All 


GUIDELINE TITLE: 


Manned Activation 


STATEMENT: PROPELLANT LOGISTICS ELEMENTS WHICH ARE DESIGNED FOR AUTOMATIC OPERATION 

SHALL INCLUDE PROVISIONS FOR LOCAL, MANUAL CONTROL DURING ACTIVATION, 
EMERGENCY OR MAINTENANCE. 


REMARKS : 

After the assembly of orbital storage facilities, or after maintenance of these facilities 
the initial operation shall be verified by using local control. If the operation to be 
conducted could introduce hazards to crewmen in the immediate vicinity, the control of 
this operation shall be exercised at a stand-off distance that is great enough to 
eliminate this hazard. 


REFERENCES: 

CROSS REFERENCES: 

HA60 

53 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 19 


HAZARD GROUP: 10 


MISSION PHASE: orbital Maintenance 


APPLICABLE SUBSYSTEMS. Maintainable Elements 


GUIDELINE TITLE: Maintenance Crew Support 


STATEMENT: PROPELLANT LOGISTICS ELEMENTS SHALL PROVIDE AN ENVIRONMENT WHICH 

CAN BE MADE HABITABLE IN ALL AREAS THAT CONTAIN COMPONENTS THAT ARE 
SUBJECT TO FREQUENT ORBITAL MAINTENANCE. 


REMARKS: 

To minimize the requirement for EVA, those components that have a high maintenance rate 
should be repairable in a shirtsleeve environment. 


REFERENCES: 


HA60, 


Study Ground Rules 


CROSS REFERENCES: 


18, 21 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 20 


HAZARD GROUP: 


MISSION PHASE: 


Orbital Assembly, Orbit, Maintenance 

APPLICABLE SUBSYSTEMS: A 11 


GUIDELINE TITLE: Propellant Logistics Element Attach Points 


STATEMENT: positive ATTACH POINTS SHALL BE PROVIDED FOR INSTALLING A PROPELLANT 
LOGISTICS ELEMENT IN A CARGO BAY WHICH DOES NOT PERMIT ANY MATING 
MISALIGNMENT OF THE LINE INTERCONNECT FIXTURE. 


REMARKS: 


Precise alignment of the line interconnect fixture is necessary to ensure that 
fluid connectors are leak-free and electrical connectors make contact between the 
shuttle and propellant modules. Orbital re-adjustments of this fixed relationship 
shall be eliminated by providing fixed attach points. 


REFERENCES: 


HA 64, 72, 90 


CROSS REFERENCES: 


38 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 21 


HAZARD GROUP: i 0 

MISSION PHASE. Orbital Maintenance 

APPLICABLE SUBSYSTEMS: 

All 



GUIDELINE TITLE: Maintenance in Restricted Areas 


STATEMENT: N0 ORBITAL MAINTENANCE SHALL BE CONDUCTED BY A SUITED CREWMAN IN- 

VOLUMES THAT DO NOT ALLOW FOR HIS RAPID RESCUE 


REMARKS: 


Any orbital maintenance by a crewman in a suit must include the possibility of 
requiring his rescue. EVA is a critical operation and working in confined spaces 
exposes him to increased hazards. These confined spaces would include the interior 
of propellant tanks, locations between the shuttle cargo and the cargo bay walls, or 
any space where the crewman does not have freedom of movement when encumbered by his 
suit or could readily be rescued by his buddy. 


REFERENCES: 


HA60 


CROSS REFERENCES: 


17, 19 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 


22 


HAZARD GROUP: 

MISSION PHASE: 

2 

Deployment, Retrieval 

APPLICABLE SUBSYSTEMS: 


All 



GUIDELINE TITLE: Power Removal Prior to Connector Operation 

STATEMENT: ALL ELECTRICAL POWER SHALL BE REMOVED FROM ELECTRICAL 


CONNECTORS AND FLUID PRESSURE SHALL BE REMOVED FROM FLUID 
CONNECTORS PRIOR TO ENGAGEMENT OR DISENGAGEMENT. 


REMARKS: 

Electrical Connectors: 

Electrical power should be removed from the conductors at a connector to minimize 
the possibility of sparking, arcing or welding of contacts by inadvertent shorting, 
prior to connecting or disconnecting. A connector should not be used as a switch. 

The ground contact of connectors should be the first one made and the last one broken. 

Fluid Connectors: 

Fluid connectors of the quick disconnect type shall be of the self-sealing type to 
minimize leakage or spillage. Any fluid connection that is not of the self-sealing 
type shall not be broken when the line contains fluid. 


REFERENCES: 


HA 63 


CROSS REFERENCES: 


63 


- 40 - SD72-SA-0054-2 





FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 23 


HAZARD GROUP: 2> 10 MISSION PHASE: Deploymenti Docking> Eetrleval 

APPLICABLE SUBSYSTEMS: Reactlon Control Systems 


GUIDELINE TITLE: Reaction Control Interface 


STATEMENT: 


THE REACTION CONTROL SYSTEM OF THE PASSIVE VEHICLE SHALL BE DEACTIVATED 
OR INTEGRATED WITH THE ACTIVE VEHICLE AS SOON AS VEHICLES ARE CAPTURED 
DURING DOCKING. 


REMARKS: 

As the supplier and user vehicles become captured prior to rigidizing during docking, 
the two vehicles can affect each other's attitude. If the reaction control system of 
the passive vehicle is not deactivated or synchronized with that of the active vehicle, 
the two RCS's could oppose each other. This would lead to high structural loads, 
possible structural damage at the docking interface as well as rapid depletion of RCS 
propellants. 


REFERENCES: (69) 


CROSS REFERENCES: 3 1 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 24 


HAZARD GROUP: 

8 

MISSION PHASE: Docking 

APPLICABLE SUBSYSTEMS: Docking 



GUIDELINE TITLE: Docking to Unstable Vehicles 

STATEMENT : DOCKING SHALL NOT BE ATTEMPTED BETWEEN VEHICLES THAT ARE NOT STABLE IN 

RELATION TO EACH OTHER 


REMARKS: 

Docking mechanisms will be designed to accept a limited amount of linear and angular 
deviation between the docking axes of the two vehicles. Any attempt to dock two 

vehicles that are moving in relation to each other could exceed the linear and angular 
tolerance and result in accidental impact or failure to capture. Consideration shall 
be given to automatic control of docking (with manual override) with inhibit circuitry 
to prevent attempts to dock vehicles whose motion cannot be synchronized. 


REFERENCES: M17 ^ g8> g6> 10? 

CROSS 

REFERENCES: 5? 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 25 


HAZARD GROUP: 12 

MISSION PHASE: 0rbltal operations 

APPLICABLE SUBSYSTEMS: 

Manipulators 


GUIDELINE TITLE: Manipulator Operation 


STATEMENT: 


ENERGY LIMITING DEVICES SHALL BE INCORPORATED INTO MANIPULATOR 
POWER SOURCES. SYNCHRONIZED AND INDEPENDENT OPERATING CAPABILITY 
SHALL BE PROVIDED FOR DUAL MANIPULATOR USE. 


REMARKS: 

Manipulator operation will be a manually controlled operation. To prevent the 
introduction of moments great enough to cause vehicle instability the energy 
that can be imparted by the manipulator should be limited by limiting the closing 
velocity to be compatible with the mass of the vehicles involved. 

When an element is being deployed out of the cargo bay by two manipulators they 
shall be synchronized to prevent the rotation of the element about its roll axis. 
When the manipulators are being used to soft dock two vehicles together they shall 
be capable of independent motion. 

Propulsive vents on propellant modules shall be held closed while the module is on 
the manipulator arms (with the monitor observing tank pressure to correct over 
pressure) to prevent the propulsive effects of unscheduled venting which could cause 
impact between vehicles. 


REFERENCES: 


HA 23, 24, 25, 36, 37, 56, CROSS REFERENCES: 49, 61, 62 

66, 78, 85, 91, 92, 97 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 26 


HAZARD GROUP: 


2 


MISSION PHASE: 


Orbital Operations 


APPLICABLE SUBSYSTEMS: Engine, Capillary Devices 


GUIDELINE TITLE: Operating With Slush Propellants 

STATEMENT: PROPELLANT LOGISTICS SYSTEMS THAT UTILIZE SLUSH 

PROPELLANTS MUST BE CAPABLE OF OPERATING WITH 
VARYING SOLID FRACTIONS. 


REMARKS: 

Heat leaks into tanks will melt the solid fraction of slush propellants. The percentage 
of solid remaining will diminish from a maximum of approximately 50% to 0% as a 
direct function of time and heat flux. 

Engine performance will vary if it is fed propellants whose solid content varies. 
Additionally, solid particles will block small engine orifices and could lead to 
local hot spots and overheating or engine loss. 

The small openings of capillary propellant settling devices will be restricted or blocked 
by the solid particles in slush. For this reason capillary devices shall not be used 
with slush propellants. 


REFERENCES: 


(76) 


CROSS REFERENCES: 


11 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 27 


HAZARD GROUP: 


MISSION PHASE: 


Orbital Operations 


APPLICABLE SUBSYSTEMS: Propellant Tanks 


GUIDELINE TITLE: 


Evaporative Freezing of 


STATEMENT : BULK QUANTITIES OF LIQUIDS SHALL 

EXTENDED PERIODS. 


Bulk Liquids 

NOT BE EXPOSED TO VACUUM FOR 


REMARKS: 

When liquids are exposed to pressures below the triple point pressure and the vent 
opening is below a limiting fraction of the liquid surface area, some liquid will 
evaporate and solidify a substantial portion of the remaining liquid. The solid will 
require an extended time to sublime if it remains in a vacuum, or if subsequently 
re-pressurized, will require an extended time to melt to a liquid. The presence of 
the undetected solid could create a hazard to subsequent operations such as maneuvers 
of re-entry. 


REFERENCES: 


CROSS REFERENCES: 


55 
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FIN 160 


ISPSS GU I DEL I ME/REQU I RE/VIEMT 


NO. 


28 


HAZARD GROUP: 


MISSION PHASE: 


Orbital Operations 


APPLICABLE SUBSYSTEMS: Vent Lines, Dump Lines 


GUIDELINE TITLE. Clogging of Manifolds With Frozen Propellants 

STATEMENT : A MEANS SHALL BE PROVIDED TO PREVENT THE ACCUMULATION OF SOLIDIFIED 

PROPELLANTS IN VENT OR DUMP LINES DISCHARGING INTO VACUUM. 


REMARKS: 

The discharge of liquids from vent lines into vacuum produces solids when a portion of 
the liquid evaporates and freezes the remainder of the liquid. These solids can build 
up around and restrict the exit area. Plugs can form if the flow is intermittent. 

When the liquid expands on freezing these plugs can completely block the line to 
subsequent flow. 


REFERENCES: _ 

20 

CROSS 

REFERENCES: 

48 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 29 


HAZARD GROUP : 2 

MISSION PHASE: Orbital Operations 

APPLICABLE SUBSYSTEMS: 

Fluid Systems 



GUIDELINE TITLE: Ejected Material 


STATEMENT: DIRECT IMPINGEMENT OF EJECTED MATERIAL ON VEHICLE SURFACES SHALL 

BE AVOIDED IN THE DESIGN AND OPERATION OF PROPELLANT LOGISTICS 
SYSTEMS . 


REMARKS: 

Products of combustion exhausted from RCS , GG and main engines; propellant, water and 
urine dumps; vented gases and leaking propellants are some of the contamination sources 
to be expected during orbital propellant logistics operations. The effluents from these 
sources characteristically expand radially outward at high velocities in a 180° flattened 
hemisphere and quickly condense into small particles. When these particles impinge on 
vehicle surfaces they can build up until sublimed by heat. This build up can block or 
restrict visual aids. On all vehicles the propulsive effect must be countered by the 
RCS, or the exits made non-propuls ive. If propellants build up on returning modules 
or in the cargo bay, they could sublime and form explosive mixtures in the cargo bay 
on re-entry. 

The thermal effects of direct plume impingement on vehicle surfaces can have catastrophic 
results. High temperature exhaust gases from RCS or other engines can destroy vehicle 
surfaces not designed to withstand these high temperatures. Cold vent gases or cryo- 
genic liquids are other extreme conditions that can damage vehicle surfaces by thermal 
shock. 


REFERENCES: 

(4A) 

CROSS REFERENCES: 3, 30, 34, 46, 51, 

56 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 30 


HAZARD GROUP: 2 


MISSION PHASE: orbital Operations 


APPLICABLE SUBSYSTEMS. y£ ew p or ts and Optical Lenses 


GUIDELINE TITLE: Protection of Visual Aids 

STATEMENT: RETRACTIBLE SHIELDS SHALL BE PROVIDED FOR CRITICAL VISUAL AIDS 

THAT COULD BE SUBJECT TO CONTAMINATION OR METEOROID BOMBARDMENT 


REMARKS: 

Venting or leaking fluids expand, at high velocity, radially outward from the source. 
These fluids quickly freeze into "ice" and adhere to surfaces they contact. To prevent 
this accumulation from restricting or blocking vision through viewports or TV lenses, 
these visual aids shall be provided with retractable covers to be used to protect 
them during periods when they could be obscured. Long term exposure to meteoroid 
bombardment could also reduce visibility and the shields shall be used during high 
density meteoroid showers. 


REFERENCES: 

HA115 

CROSS 

REFERENCES: ,, ,, 

35,56 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 


31 


HAZARD GROUP: 

2 

MISSION PHASE: 



Orbital Operations 


APPLICABLE SUBSYSTEMS: 

Reaction Control System (RCS) 


GUIDELINE TITLE: RCS Capability 


STATEMENT: THE RCS OF PROPELLANT LOGISTICS ELEMENTS, OR COMBINATION OF 

ELEMENTS, SHALL BE CAPABLE OF MAINTAINING THE STABILITY OF 
PROPELLANT LOGISTICS ELEMENTS UNDER ALL CONDITIONS. 


REMARKS: 

The RCS is the prime means of establishing and maintaining the stability of orbital 
units or assembly of units. When the elements have been designed to be inherently 
stable there are forces that would tend to upset this stability if not counteracted 
by the RCS. Among these forces would be: 

1. Docking impact 

2. Fluid sloshing 

3. Uncoordinated RCS action between docked vehicles 

4. Propulsive venting 

5. Propulsive effect of leaking propellants 

6. CG migration 

7. Dynamic coupling or overall vehicle dynamics 

8. Intermittent propellant supply or lack of propellants to RCS 

In the final design, all of these subjects shall be fully investigated and resolved 
in the design process. 


REFERENCES: ^ 17 


39, 41, 46, 99, 


105 


CROSS REFERENCES: 


23, 32, 33, 34, 41 
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FIN 160 


I SPSS GUIDELINE/REQUIREMENT 


NO. 32 


HAZARD GROUP: 


2, 8, 9, 12 


MISSION PHASE: 


Orbital Operations 


APPLICABLE SUBSYSTEMS: Shock Absorbers, Slosh Control, RCS 


GUIDELINE TITLE: Uncontrolled Oscillations 


STATEMENT: when PROPELLANT LOGISTICS ELEMENTS ARE JOINED OR BEING JOINED THE 

STABILITY OF THE ENTIRE CONFIGURATION SHALL BE CONTROLLED TO PREVENT 
DISTURBANCES WHICH ARE DETRIMENTAL TO THE SYSTEMS OR CREW. 


REMARKS: 

Disturbances must not be allowed to build up to the point that human or systems performance 
is degraded. Some factors that would tend to cause disturbances are: 

1. Docking impact - both momentum and resulting fluid excursion 

2. Fluid sloshing 

3. Uncoordinated RCS action between docking or docked vehicles 

4. Propulsive venting 

5. Propulsive effect of leaking propellants 

6. C.G. migration 

7. Dynamic coupling or overall vehicle dynamics 

8. Intermittent, or depleted propellants to RCS 


REFERENCES: 

CROSS 

REFERENCES : 

HA 120, 166 


31 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 33 


HAZARD GROUP: 8 , 12 MISSION PHASE: orbital Operations 

APPLICABLE SUBSYSTEMS:, slosh Control ~ 


GUIDELINE TITLE: 


Fluid Sloshing 


STATEMENT: SLOSH PREVENTING AND DAMPING DEVICES SHALL BE INCORPORATED INTO THE 

PROPELLANT TANKS OF PROPELLANT LOGISTICS ELEMENTS. 


REMARKS: 

Fluid sloshing under the conditions encountered in propellant logistics operations 

remains one of the largest contributors to vehicle instability. The design process 
must include a study of the ways that fluid sloshing is introduced and establish 
means to ensure that sloshing is not started or minimized and does not contribute 
to vehicle instability. 


REFERENCES: HA4 , 46, 51, 52, 97, 120, 121, CROSS REFERENCES: 24, 25, 31, 39, 

161 41, 42 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 34 


HAZARD GROUP: 2> g 

MISSION PHASE: 

Orbital Operations 

APPLICABLE SUBSYSTEMS: Vents> 0utlet 

s 


GUIDELINE TITLE : Non-Propulsive Vents 


STATEMENT: EXHAUST GAS AND TANK VENT OUTLETS OF PROPELLANT LOGISTICS ELEMENTS 

SHALL BE DESIGNED SO THAT THE PROPULSIVE EFFECT OF VENTING FLUIDS 
WILL NOT ADVERSELY AFFECT THE STABILITY OF THE ELEMENTS. 


REMARKS: 

The design process must evaluate the placement and pointing direction of venting fluids. 
The unscheduled propulsive venting of the tanks on a single element could impart an 
acceleration that would create vehicle instability, jeopardizing the trajectory of the 
element or causing impact on neighboring vehicles. When elements are joined for transfer 
the ejected materials could impact on visual aids and cause hazards to vision. During 
the docking operation propulsive venting could change the approach velocity and cause 
accidental impact or failure to capture. 


REFERENCES: 


CROSS REFERENCES: 


HA22, 125, 159 


31 
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FIN 160 


ISP SS GUIDELINE/REQUIREMENT 


NO. 35 


HAZARD GROUP: 

8 

MISSION PHASE: 



Orbital Operations 


APPLICABLE SUBSYSTEMS: 

All 


GUIDELINE TITLE: Orbiting Debris 


STATEMENT: THE COLLISION OF PROPELLANT LOGISTICS ELEMENTS WITH SPACE 

DEBRIS SHALL BE AVOIDED BY THE CHOICE OF LAUNCH WINDOW AND 
ORBITAL FLIGHT PATH. 


REMARKS: 

Ground tracking radar information can provide a launch window to enable propellant 
logistics elements to be timed to miss space debris that is detectible by such radar. 
Once an element achieves orbit, the bigger it is and the longer it stays in orbit 
increases the probability of being struck and damaged by orbiting debris. Reference 
12A, Volume III, Appendix H, cites a probability of 0.002 for a space station 
(approximately the size of a large storage facility) orbiting at a 200 nautical mile 
altitude being struck by debris of 5 feet to 30 feet in size within ten years. If 
other debris were included the probability would increase. The hazard of propellant 
logistics elements being struck by debris is a residual one and continued effort 
must be expended to reduce it. 


REFERENCES: 


HA 15, 103, (12A) 


CROSS REFERENCES: 


36 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 36 


HAZARD GROUP: 

MISSION PHASE: 

2 

Orbital Operations 

APPLICABLE SUBSYSTEMS: 


All Exposed Elements 



GUIDELINE TITLE: Meteoroid Shields 

STATEMENT: METEOROID SHIELDS SHALL BE PROVIDED FOR CRITICAL COMPONENTS 

AND SYSTEMS OF PROPELLANT LOGISTICS ELEMENTS. 


REMARKS : 

The impact of meteoroids on propellant logistics elements can reach a high 
probability depending on orbital altitude, size of element, and orbital stay time. 
A meteoroid shield that will absorb the impact of meteoroids of one gram mass with 
velocities of 25 - 30 km/sec is considered the minimum protection for critical 
components. 


REFERENCES: 


HA 14, 43, 153, 


157, 


(12A) 


CROSS REFERENCES: 


30 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 37 


HAZARD GROUP: 

MISSION PHASE: 

2 

Propellant Transfer 

APPLICABLE SUBSYSTEMS: User Propellant Tanks 

and Lines 


GUIDELINE TITLE: 


Chilldown 


STATEMENT: 


THE USER PROPELLANT TANKS AND LINES SHALL BE COOLED DOWN SLOWLY TO 
REDUCE THE THERMAL SHOCK OF FULL CRYOGENIC FLOW. 


REMARKS: 


A sudden transition from a relatively warm, empty state to cryogenic temperatures could 
introduce stresses in the user propellant tanks or lines that would exceed their design 
limits. The results could be catastrophic and require the return of the vehicle for ground 
repairs. 


REFERENCES: 

CROSS 

REFERENCES: 

HA3, 133, 162 


55, 56 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 38 


HAZARD GROUP: 


MISSION PHASE: 


Propellant Transfer 


APPLICABLE SUBSYSTEMS: Propellant Transfer Lines 


GUIDELINE TITLE: Velocity Head Suppression 

STATEMENT: A MEANS SHALL BE PROVIDED TO SUPPRESS VELOCITY HEAD DURING PROPELLANT 

TRANSFER OPERATIONS TO PREVENT OVER PRESSURIZATION. 


REMARKS: 

In the case of propellant transfer by pumping expulsion the sudden closure of valves in 
the discharge line could subject the discharge lines to pressures that exceed the design 

limit. To eliminate excessive pressure the design of the propellant transfer system 
should include some method of preventing this occurrence or absorbing it if it did occur. 
Electrical interlocks between the pump and valves would prevent this occurrence or 
surge chambers would absorb the pressure. 


REFERENCES: 


(31) 


CROSS REFERENCES: 


29, 58 


- 56 - SD72-SA-0054-2 






FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 39 


HAZARD GROUP : 2 


MISSION PHASE: Propellant Transfer 


APPLICABLE SUBSYSTEMS: 

Propellant Settling 


GUIDELINE TITLE: Vapor Pull-Through 

STATEMENT : ANTI-VORTEX OR OTHER DEVICES SHALL BE INCORPORATED IN TANK OUTLETS 

TO MINIMIZE VAPOR PULL-THROUGH DURING PROPELLANT TRANSFER OPERATIONS. 


DCLIApl^C * 

Vapor pull-through can introduce variations in propellant flow. Alternate 
liquid and vapor could be introduced into discharge lines and produce variations in 
residual propellants. 

The performance of gas generators, pumps, RCS or other units that utilize propellants 
from the main tanks would be adyersely affected by intermittent gas and liquid flow. 

It is for these reasons that effective liquid/vapor interface control be implemented 
and vapor pull-through be minimized. 


REFERENCES: 


HA 82, 


119, 


166 


CROSS REFERENCES: 


41, 42 
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FIN 160 


I SPSS GUIDELINE/REQUIREMENT 


NO. 40 


HAZARD GROUP : 1 

MISSION PHASE: Propellant Transfer 

APPLICABLE SUBSYSTEMS: 

Gas Generator 



GUIDELINE TITLE: Gas Generator Safety Devices 


STATEMENT : SAFETY DEVICES SHALL BE INCORPORATED INTO THE GAS GENERATOR OUTLET TO 

REDUCE OR TERMINATE PROPELLANT FLOW TO THE GG IF EITHER TEMPERATURE OR 
PRESSURE BECOMES EXCESSIVE OR UNSTABLE. 


REMARKS: 

Gas generators characteristically operate fuel-rich as compared to an engine 
designed to produce thrust. If the fuel supply is interrupted or reduced the output 
pressure and temperature go up. If the fuel supply is stopped the hot engine is 

quickly destroyed by oxidation. 


REFERENCES: 


HA 48, 50, 118, 


123 


CROSS REFERENCES: 


63 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 41 


HAZARD GROUP: 2, 7, 8, 9 

MISSION PHASE: 

Propellant Transfer 

APPLICABLE SUBSYSTEMS: 

Propellant Tanks 



GUIDELINE TITLE: .RCS & Gas Generator Propellant Accumulator 

STATEMENT: A MEANS SHALL BE PROVIDED TO INSURE THE AVAILABILITY OF PROPELLANTS 

TO THE RCS AND GAS GENERATOR. 


REMARKS: When the RCS or gas generator utilizes propellants from the main tank to 

produce thrust to settle the propellants under zero "G" conditions, liquid propellant 
will not be available or will be available intermittently on start-up. Accumulators, 
"start-boxes" or other devices shall be incorporated to insure the availability of 
liquid propellants at the device during start-up. 

When RCS propellants are supplied from the main tanks propellant transfer to the user 
could deplete the main tanks and lead to the inability to maintain control of the 
vehicle because of the lack of propellants for the RCS. 


REFERENCES: 


HA 45, 49, 


117, 121 


CROSS REFERENCES: 


40 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 42 


HAZARD GROUP: 


MISSION PHASE: 

Propellant Transfer 


APPLICABLE SUBSYSTEMS: Propellant Transfer Pumps 


GUIDELINE TITLE: 
STATEMENT: 


Propellant Transfer Pumps 

ORBITAL PROPELLANT PUMPS SHALL BE CAPABLE OF WITHSTANDING TWO- 
PHASE FLOW. 


REMARKS: 

Pumps that are used for orbital propellant transfer will be exposed 
to alternate gaseous and liquid propellants at the inlet of the pump. This condition 
will prevail at start-up and shut-down and could occur at intermediate intervals 
The pump should be designed such that it will withstand two-phase flow without 
affecting pump performance. 


REFERENCES: 


CROSS REFERENCES: 


HA 83 


39, 41 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 43 


HAZARD GROUP: 2 MISSION PHASE: Propellant Transfer 

APPLICABLE SUBSYSTEMS: Rotating Machinery 


GUIDELINE TITLE: Rotating Machinery 


STATEMENT: 


ROTATING ELEMENTS SHALL BE LOCATED OR SHIELDED TO PREVENT DAMAGE 
FROM EXPLODING FRAGMENTS. 


REMARKS: Rotating machinery, such as turbine wheels, could overspeed and explode 

when exposed to excessive propulsive energy due to control failure. Such rotating 
devices shall be located or shielded such that the fragments or shrapnel from this 
explosion will not damage adjacent components. 


REFERENCES: 


HA 84 


CROSS REFERENCES: 


61 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 44 


HAZARD GROUP : 

2 

MISSION PHASE: 

Propellant Transfer 

APPLICABLE SUBSYSTEMS: 

Capillary Devices 



GUIDELINE TITLE: 


Capillary Propellant Settling 


STATEMENT: CAPILLARY BARRIERS BE DESIGNED TO PROVIDE POSITIVE VAPOR-LIQUID 

SEPARATION AND BE STRUCTURALLY CAPABLE OF WITHSTANDING PROPELLANT 
SLOSHING AND THE IMPACT OF SOLID PROPELLANTS. 


REMARKS: The capillary devices that must be placed in the propellant tanks to utilize 

this method of propellant settling are more fragile than other structural components 
of the tanks. Capillary screens and channels are subject to being blocked by solidified 
particles, and if the propellant pumps placed a large delta pressure across the screens, 
total loss or damage could result. This restriction could prohibit the use of slush 
propellants with capillary settling devices and place further restrictions on operations 
that would tend to form solid particles. If the tank pressure dropped below the triple 
point pressure, either deliberately or accidentally, solid particles or chunks would 
be formed that could cause structural damage to screens. In addition to damage caused 
by solid particles the capillary devices must be designed to resist the impact of 
sloshing propellants and "g" forces introduced by acceleration. 


REFERENCES: 

CROSS REFERENCES: 

27, 39, 63 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 45 


HAZARD GROUP: 


MISSION PHASE: 


Propellant Transfer 


APPLICABLE SUBSYSTEMS: Propellant Tanks and Lines 


GUIDELINE TITLE: Strainers and Filters 

STATEMENT: STRAINERS OR FILTERS SHALL EE PROVIDED UPSTREAM OF DEVICES OR COMPONENTS 

THAT COULD BE BLOCKED OR RESTRICTED BY SOLID PARTICLE CONTAMINATION. 


REMARKS: 


Contamination control shall be exercised to prevent the introduction 
of propellants that are contaminated beyond acceptable levels. The repetitive filling 
and draining of orbital elements could accumulate contamination that would exceed 
allowable levels. Components that contain small orifices, such as gas generators 
and RCS engines, shall be provided with filters that are capable of eliminating solid 
particles that could block these orifices. 


REFERENCES: 


HA2, HA9 , HA10, 22, 84 


CROSS REFERENCES: 
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FIN 160 


I SPSS GUIDELINE/REQUIREMENT 


NO. 46 


HAZARD GROUP : 2 

MISSION PHASE: Retrieval 

APPLICABLE SUBSYSTEMS: 

All 



GUIDELINE TITLE: c . .. 

Sublimation of Solid Propellants 


STATEMENT: PROPELLANT MODULES THAT HAVE BEEN DE-PRESSURIZED TO VACUUM SHALL NOT BE 

RETURNED IN THE SHUTTLE AS LONG AS SOLID PROPELLANTS REMAIN IN PROPELLANT 
TANKS. SOLIDIFIED PARTICLES OF PROPELLANTS ON MODULE OR CARGO BAY SURFACES 
SHALL NOT BE DE-ORBITED, BUT DELAYED UNTIL SOLIDS HAVE SUBLIMED. 


REMARKS: 

Solidified propellants will sublime in a vacuum at a rate that is dependent on the heat 
input. The hazards involved with de-orbiting solidified propellants are associated with 
subliming inside the cargo bay during de-orbit and resulting in fire/explosion when mixed 
with atmospheric oxygen entering through the cargo bay vents. Additional risks are 
associated with larger chunks that could be formed inside propellant tanks that could 
damage or rupture the tanks during maneuvers and discharge more propellants inside the 
cargo bay. 

To minimize the possibility of returning solidified propellants inside a module 
tank, the only feasible alternate is to leave the module in orbit until heat leaks 
through the insulation will liquefy or sublime the solids. The time to accomplish 
this would vary with the quality of the insulation and the amount of solidified 
propellant. 

A visual inspection of the cargo bay will verify the presence of "ice" or "snow". 

If present the cargo bay could be oriented toward the sun and the solar heat flux 
of 442 Btu/ft^ over an area 15 x 60 feet would dissipate approximately 1800 pounds 
of solidified, hydrogen per hour. 


REFERENCES: Vol. Ill Section 4.2 


CROSS REFERENCES: 

3, 27, 28, 30, 47, 48, 51, 55 
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ISPSS GUIDELINE/REQUIREMENT 


NO. 47 


HAZARD GROUP: 


MISSION PHASE: 


Retrieval, Re-Entry 


APPLICABLE SUBSYSTEMS: Propellant Tanks, Lines and Vents 


GUIDELINE TITLE: Orbital Leak Checks 


STATEMENT: leak CHECKS SHALL BE PERFORMED ON PROPELLANT LOGISTICS SYSTEMS TO VERIFY 

THAT LEAKAGE IS WITHIN TOLERANCE PRIOR TO FLUID TRANSFER OR PRIOR TO 
RE-ENTRY IN THE SHUTTLE CARGO BAY. 


REMARKS: 

A means of leak detection must be provided for all propellant containers and inter- 
connections. These provisions shall be used prior to initiating propellant transfer 
in orbit and to eliminate the possibility of mixing propellants whose total pressure 
could reach 2 mm Hg to minimize the possibility of fire/explosion. 

A propellant module to be returned shall be visually inspected for damage and the 
evidence of leakage, since orbital liquid propellant leaks are highly visible. The 
cargo bay shall be visually inspected for evidence of solidifed propellants that have 
been deposited by propellant leaks. If there is evidence of propellant leakage on the 
modules it shall not be returned by shuttle until the propellant leakage terminates. 

If solidified propellants are evident in the cargo bay the orbiter shall not re-enter 
until the solids have sublimed. After emplacement the connection between the module 
and shuttle shall be verified to be leak free and the module itself be free of leaks 
prior to re-entry. 


REFERENCES: 

Ref. Vol. 


HA 73, 79, 90 
III Section 4.2.5 


(17), 


CROSS REFERENCES: 


13 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 48 


HAZARD GROUP: l MISSION PHASE: Re-Entry 


APPLICABLE SUBSYSTEMS. Propellant and Pressurization 


GUIDELINE TITLE: orbital Propellant Dump 

STATEMENT: PR0PELLANTS SHALL BE DUMPED FROM PROPELLANT LOGISTICS TANKS PRIOR TO 

DE-ORBIT AND RE-ENTRY IN A MANNED VEHICLE. 


REMARKS: 

Instrumentation errors could lead to returning propellant logistics elements in the 
shuttle with an unknown quantity of liquid propellants remaining in the tank. To 
minimize the fire and explosion hazard to the orbiter and crew the propellants shall 
be dumped prior to re-entry. The landing weight of the element could exceed the 40 k lb. 
limitation imposed by the orbiter with an unknown quantity of propellants aboard. A tank 
rupture would leak to the loss of the orbiter and crew. 

The residual propellants in the tanks shall be no greater than that amount which 
could be vented without over-pressurizing the tanks if all the liquid were suddenly 
converted to gas by contacting hot spots on the tank walls. 


REFERENCES: HA 74 CROSS REFERENCES: 3> 12> 13> 14> 55 
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ISPSS GUIDELINE/REQUIREMENT 


NO. 


49 


HAZARD GROUP: 


MISSION PHASE: 


Manned Operations 


APPLICABLE SUBSYSTEMS: 


Man 


GUIDELINE TITLE: Crew Fatigue 


STATEMENT: 


DURING MANNED PROPELLANT LOGISTICS OPERATIONS NO CREW MEMBER SHALL 
BE PLACED IN A CONTROL SITUATION WHEN HIS RESPONSE HAS BEEN DEGRADED 
BY FATIGUE. 


REMARKS: 


It can be anticipated that many propellant logistics operations will demand long hours 
from orbiting crewman. Procedures shall be developed for such operations that will 
provide time for meals and rest such that when human control is necessary the crewman 
is alert and capable of responding. 


REFERENCES: 

CROSS REFERENCES: 

HA40 

62 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 50 


HAZARD GROUP: 


All 


MISSION PHASE: 


All 


APPLICABLE SUBSYSTEMS: 


All 


GUIDELINE TITLE: Redundancy 

STATEMENT : THE CAPABILITY SHALL BE PROVIDED FOR PERFORMING CRITICAL FUNCTIONS AT A 

NOMINAL LEVEL WITH ANY SINGLE COMPONENT FAILED. 


REMARKS: 

The single most prevalent preventive measure identified by the preferred hazard reduction 
method was some form of redundancy. Sixty-six identified hazards required redundancy 
to reduce their potential. These systems and the number of times they were identified 
included the following: 


RCS - 20 
Communications - 8 
Docking Devices - 8 
Valves - 8 
ECLSS - 5 
Computer - 5 


Other systems that required redundancy to reduce the hazard potential were identified 
fewer than 5 times. It is evident that the provision of redundant systems elements is 
critically important for the continued function of propellant logistics systems. 


REFERENCES: MSCM 8080 

66 individual hazard analyses 


CROSS REFERENCES: 


31, 57, 59 
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«0T kll J 


ISPSS GUIDELINE/REQUIREMENT 


NO. 51 


HAZARD GROUP: i 

MISSION PHASE: A 11 

APPLICABLE SUBSYSTEMS: 


Potential Propellant 

Leak Points 


GUIDELINE TITLE: Confined Compartments 


STATEMENT : THE DESIGN OF PROPELLANT LOGISTICS ELEMENTS SHALL ELIMINATE THE 

POSSIBILITY OF MIXING PROPELLANTS IN ANY SPACE WHERE THE COMBINATION 
COULD REACH PRESSURES OF 2 mm Hg OR GREATER UNDER ANY COMBINATION 
OF LEAKAGE CONDITIONS. 


REMARKS: 

Reactions that result in f ire/explosion in the oxygen-hydrogen system can be initiated 
when the percentage of hydrogen is 4 percent by volume or greater, when oxygen is 2 percent 
by volume or greater, and the local pressure is 2 mm Hg or greater. For this reason 
potential leak sources shall not be confined, but open to the ambient atmosphere. Un- 
like propellant leak sources shall be physically separated as far as possible. Tank 
vents of propellant logistics elements must be provided with a closed, leak checked, 
venting and dumping system that terminates in the ambient atmosphere outside the cargo 
bay. 


REFERENCES: 


HA45, 115, 116, 163 


CROSS REFERENCES: 


46, 47, 48 


3, 6, 7, 14, 28, 29 
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FIN 160 


ISPSS GU I DELI NE/REQU I REMENT 

HAZARD GROUP: 2 MISSION PHASE: 

APPLICABLE SUBSYSTEMS: A11 

GUIDELINE TITLE: Operations Monitor 

STATEMENT: ^ OPERATIONS MONITOR SHALL BE PROVIDED THAT IS AWARE OF THE STATUS OF 

ORBITAL PROPELLANT LOGISTICS OPERATIONS AND HAS THE CAPABILITY OF 
ASSUMING MANUAL CONTROL OF AUTOMATIC OPERATIONS. 



REMARKS: 

The man/machine interface is established by the operations monitor. Communications 
shall be established between the orbital element and a manned control station. 

The man shall be aware of the progress of events and have the ability to over-ride 
automatic operations and use his reasoning ability to safely by-pass interruptions 
and complete the mission. Procedures shall be developed to place the operations 
monitor in command that is closest to the operation under way. If a station keeping 
orbiter is present or during orbiter attached rotation the orbiter crew-man shall be 
in control. If no manned element is present in orbit adjacent to the operation in 
progress then a ground monitor shall be provided. 


\ 

r 

l 

L 

REFERENCES: HA 57> 58> 61 CROSS REFERENCES: “ ~ 
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ml iou 


ISPSS GUIDELINE/REQUIREMENT 


NO. 53 


HAZARD GROUP: 2 

MISSION PHASE: All 

APPLICABLE SUBSYSTEMS: m 



GUIDELINE TITLE: Manual Override of Automatic Propellant Logistics Operations 


STATEMENT : PROVIDE FOR MANUAL INTERRUPTION AND CONTROL OF AUTOMATIC PROPELLANT 

LOGISTICS FUNCTIONS. 


REMARKS: 

Fully automatic, local control of an operation as complex as orbital propellant 
transfer is within the state of the art. It is visualized, however, that failures of 
these automatic sequences will occur. When these failures occur the capability must 
exist to manually interrupt the automatic sequences to perform trouble shooting and 
analyses in order to complete the logistics mission. 


V 


REFERENCES: 

(71), (75) 

CROSS 

REFERENCES : ^ ^ „ 
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FIN lbU 


ISPSS GUIDELINE/REQUIREMENT 


NO. 54 


HAZARD GROUP : 2 

MISSION PHASE: All 


APPLICABLE SUBSYSTEMS: An 




GUIDELINE TITLE: Systems Interlocks 


STATEMENT: 


INTERLOCKS SHALL BE PROVIDED TO PREVENT THE OCCURRENCE OF OUT-OF-SEQUENCE 
EVENTS THAT COULD LEAD TO SYSTEM DAMAGE BECAUSE OF INADEQUATE PREPARATION 
FOR SUBSEQUENT EVENTS. 


REMARKS: 

The successful completion of complex operations is the result of many discrete 
steps. Automatic or manual controls shall be implemented to insure that no 
essential step is omitted. Monitors shall be provided to insure that no critical 
manual steps are skipped. Where possible, automatic features shall be designed into 
propellant logistics systems to minimize the possibility of inadequate preparations. 

The final operational mode and configuration shall be studied to preclude the 
possibility of translating a docked element before separation, of initiating propellant 
flow before chilldown, of attempts to engage line interconnect fixtures before retracting 
the meteroid shield, or any other manual or automatic step that could lead to systems 
damage. 


REFERENCES: 


HA 43, 145 


CROSS REFERENCES: 


52, 63 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 


55 


HAZARD GROUP : 2 

MISSION PHASE: 

All 

APPLICABLE SUBSYSTEMS: 

Propellant Tanks 



GUIDELINE TITLE: M . n D „ 

Monitoring Quantity of Propellants 

STATEMENT: PROVISIONS SHALL BE INCORPORATED IN ALL PROPELLANT LOGISTICS STORAGE 

TANKS TO MEASURE THE QUANTITY OF PROPELLANTS IN THE TANK. 


REMARKS: 

The quantity of propellants in the tanks shall be known to the monitor for successful 
completion of propellant logistics operations. Dead reckoning will not provide an 
accurate account of the propellants available from the main tanks to the RCS to maintain 
vehicle stability for recovery by the shuttle after having discharged a partial load 
to a user. An accurate propellant measuring system in the supplier vehicle will provide 
a cross check in the user vehicle to verify that enough propellants are aboard the 
user to complete its mission. 

In case a zero g propellant gaging system is not available, conventional gravitational 
techniques could be used, but would permit gaging only while the propellant is subjected 
to acceleration. 


CROSS REFERENCES: 3 , n, 12 , 14 , 27, 46 , 
48 


- 73 - 
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REFERENCES: HA 47, 83, 88, 119, 122, 165 







FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 56 


HAZARD GROUP: 2, 3, 4 


MISSION PHASE: All 


APPLICABLE SUBSYSTEMS: 


All 


GUIDELINE TITLE: 


Materials Compatibility 


STATEMENT: 


MATERIALS OR COMPONENTS ADJACENT TO FLUID LINES OR CONTAINERS SHALL 
BE COMPATIBLE WITH LEAKING FLUIDS 


REMARKS: 


It can be expected sometime during the use of propellant logistics systems that leaks 
will develop. Any component or structural element that could be exposed to this leakage 
must be capable of withstanding the effects of the fluids that leak out, whether the 
leaks occur on the pad or in orbit. Consideration shall be given to the thermal shock 
of leaking cryogens, rapid oxidization of combustible materials by leaking oxygen, the 
thermal effects of leaking hydrogen that burns in the air, and the corrosive effect of 
leaking nitrogen tetroxide. 


REFERENCES: 

CROSS 

REFERENCES: 

SPD-1A 


29 


- 74 - 
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ISPSS GUIDELINE/REQUIREMENT 


NO. 57 


HAZARD GROUP: 2 

MISSION PHASE: A11 

APPLICABLE SUBSYSTEMS: 

All 



GUIDELINE TITLE: Automatic Operation 

STATEMENT: REPETITIVE PR.OPELLANT LOGISTICS OPERATIONS SHALL BE AUTOMATED. 


REMARKS: 

The performance of man is subject to individual variations. His response is dependent 
on his training, experience, emotional stability, the amount of rest he has been 
permitted, and others. Any operation that is repeated shall be studied for automation 
to prevent variable performance and relieve man for the role he performs best and for 
which he will be the most useful in propellant logistics operations, such as problem 
solving and corrective action. 


REFERENCES: HA20, 
107, 108, 112, 130, 
176 (75) 


29, 

133 


30, 32, 99, 101 
134, 145, 154, 


, 105 
162, 


CROSS REFERENCES: 


) 
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FIN 160 


ISPSS GU I DEL I NE/REQU I REMENT 


NO. 58 


HAZARD GROUP: 1 


MISSION PHASE: A11 


APPLICABLE SUBSYSTEMS: Propellant and Pressurization 


GUIDELINE TITLE: 


Pressure Relief 


STATEMENT : PRESSURE RELIEVING DEVICES SHALL EE INCORPORATED INTO CLOSED SYSTEMS 

THAT WILL RESTRICT THE PRESSURE OF THE SYSTEM TO DESIGN LIMITATIONS. 


REMARKS: 

Locked up gases can expand upon being heated and rupture the line or tank that contains 
them. Trapped cryogens will gasify upon being heated, with a volume change of 
approximately 800:1, and rupture their container. Therefore, each closed liquid 
container shall be provided with a pressure relieving device. 


REFERENCES: HAllj 63, 80, 82, 167 

CROSS 

REFERENCES: OQ 

JO 
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UN ibu 


ISPSS GUIDELINE/REQUIREMENT 


NO. 59 


HAZARD GROUP: 11 

MISSION PHASE: All 

APPLICABLE SUBSYSTEMS: 

C ommunic ations 



GUIDELINE TITLE: Communications Blackout 


STATEMENT: DURING THE ROTATION OF PROPELLANT LOGISTICS ELEMENTS, 

EITHER AROUND ITS OWN AXIS OR THAT OF THE EARTH, A MEANS 
SHALL BE PROVIDED TO ENSURE CONSTANT COMMUNICATION BETWEEN THE 
ELEMENT AND THE MONITOR. 


REMARKS: 

Successful mission completion demands the knowledge of system status aboard 
unmanned orbiting propellant logistics elements or assemblies. Prior to 
initiating propellant transfer, during the extended period of the propellant transfer 
and during the retrieval operation the monitor must be aware that the systems have 
been prepared for the next operation. 


REFERENCES: 


HA 69, 104 


CROSS REFERENCES: 


52, 61, 63 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 60 


HAZARD GROUP: 

2 

MISSION PHASE: 

All 


APPLICABLE SUBSYSTEMS: 

All Operating System! 

5 



GUIDELINE TITLE: Man-Compatibility 

STATEMENT: DURING MANNED PROPELLANT LOGISTICS OPERATIONS NO ATTACHED 


ELEMENT SHALL DEGRADE THE MAN-RATING OF THE MANNED ELEMENT. 


REMARKS: 

Manned vehicles must be designed and operated with safety factors and levels of 
redundancy such that they can be classed as "man-rated." Unmanned vehicles will 
not necessarily be restricted to this degree. 

Whenever an unmanned element is in close proximity to a manned element such as 
transport to orbit in the cargo bay of the shuttle or propellant transfer with 
orbiter attached the unmanned element shall be man-compatible by being designed or 
operated in a manner such that the man-rating of the orbiter will not be jeopardized. 

Human factors shall be considered during the operation of manned propellant logistics 
systems, such as: the degradation of human performance while being rotated during 

rotational transfer for an extended period. 


REFERENCES: 


HA 146 


CROSS REFERENCES: 


49 
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ISPSS GUIDELINE/REQUIREMENT 


NO. 


61 


HAZARD GROUP: 2 


MISSION PHASE: All 


APPLICABLE SUBSYSTEMS: 


All Manual Operations 


GUIDELINE TITLE: Crew Training 

STATEMENT: PROGRAMS SHALL be IMPLEMENTED TO TRAIN PROPELLANT LOGISTICS 

CREWMEN IN ALL MANUAL OPERATIONS 


REMARKS: 

All ground and airborne crew members shall be trained in all operations, normal and 
emergency, they are to perform. Trainers shall be developed to closely simulate the 
conditions to be experienced when performing the actual operation. 


REFERENCES: ha21, 58, 59, 63, 64, 65, 86, CROSS REFERENCES : 62 

89, 94, 96, 124, 127, 132, 138, 172, 173 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 62 


HAZARD GROUP: 2 

MISSION PHASE: M1 


APPLICABLE SUBSYSTEMS: A11 ^ operations 




GUIDELINE. TITLE : Procedures Development 

STATEMENT : ALL MANUAL OPERATIONS SHALL BE GUIDED BY WRITTEN PROCEDURES THAT 


INCLUDE NORMAL AND EMERGENCY OPERATIONS 


REMARKS: 

Procedures shall be developed that cover all manual operations. Safety precautions 
and emergency or back-out procedures shall be included in the text at the point at 
which they are applicable. A ground monitor that is not subject to other distractions 
shall use such procedures as check-off lists to ensure that no essential step performed 
in orbit is omitted. 


REFERENCES: HA21, 29, 36, 52, 58, 59, 60, 61, 62,63, 

65,68,72,73,79,85,88,90,93,94,98,102,105,109, 


CROSS REFERENCES: 


52, 61 


111, 112, 118,119,124,126,127,129,130,132-138, 
147, 155-158, 160, 164, 168, 171, 172, 174, 176- 
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FIN 160 


ISPSS GUIDELINE/REQUIREMENT 


NO. 63 


HAZARD GROUP: 2 

MISSION PHASE: All 

APPLICABLE SUBSYSTEMS: 

All 



GUIDELINE TITLE: Malfunction Detection and Warning Devices 

STATEMENT: DEVIATIONS OF NORMAL OPERATING CONDITIONS SHALL BE 


DISPLAYED TO THE OPERATIONS MONITOR. 


REMARKS: 

The design process shall include an evaluation of the malfunction detectors to be 
provided and the manner in which this information is to be displayed. Warning 
devices to be considered will include: 


1. Over and under pressure 

2. Over and under temperature 

3. Over and under voltage 

4. Operation on reserves 

5. Operation on redundant systems 

6. For time critical emergencies the provision of and initiation 
of automatic corrective action 

7. Environmental conditions in LSS 


REFERENCES: HA 33, 53, 55, 69, 72, 80, 
100, 109, 114, 124, 125, 142, 157 


CROSS REFERENCES: 


6, 7, 54 
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